Skip to main content
The Lei Geral de Protecao de Dados (LGPD, Law No. 13,709/2018) is Brazil’s comprehensive data protection law, in effect since September 2020. Enforced by the ANPD (Autoridade Nacional de Protecao de Dados), LGPD regulates how organizations collect, process, store, and share personal data of individuals in Brazil. When your AI application processes personal data of individuals located in Brazil, LGPD applies. Blindfold helps by tokenizing personal data before it reaches any AI provider. The LLM only sees anonymized tokens like <Person_1> — never real names, CPFs, or addresses.

Who Must Comply

LGPD applies to:
  • Any organization processing personal data of individuals located in Brazil
  • Regardless of where the organization is headquartered — a US or EU company processing Brazilian data must comply
  • When data processing occurs in Brazil, when data subjects are in Brazil, or when data was collected in Brazil
LGPD applies extraterritorially — your company doesn’t need to be in Brazil. If you process personal data of individuals in Brazil, you must comply.

Key LGPD Requirements

Requirement: Data subjects have the right to confirmation of processing, access, correction, anonymization of unnecessary data, deletion, data portability, information about third-party sharing, and information about denying consent.With Blindfold: Use tokenize() for anonymization, redact() for deletion, and detect() to identify what personal data exists. Audit logs document all processing activities for access requests.
Requirement: Personal data may only be transferred to countries with adequate protection levels, or with specific guarantees such as Standard Contractual Clauses, binding corporate rules, or specific consent from the data subject.Risk with AI: Most AI providers (OpenAI, Anthropic) process data in the US, which may not meet LGPD adequacy requirements.With Blindfold: Use the EU region (region="eu") — PII is tokenized before crossing borders. Only anonymized tokens reach the AI provider, which are no longer personal data under LGPD.
Requirement: The ANPD may require a Data Protection Impact Assessment (DPIA / RIPD) when processing activities may create risks to data subjects’ fundamental rights and freedoms.With Blindfold: Blindfold’s audit trail documents all PII detection and anonymization, providing evidence for your DPIA that personal data is protected before AI processing.
Requirement: Organizations must appoint a DPO (Encarregado) whose identity and contact information must be publicly disclosed. The Encarregado handles data subject requests, advises on data protection practices, and communicates with the ANPD.With Blindfold: Audit logs and processing records from Blindfold support the DPO’s oversight responsibilities by documenting how personal data is protected in AI workflows.

LGPD vs GDPR

LGPD is closely modeled on the EU’s GDPR, but there are important differences:

How Blindfold Maps to LGPD

EU Region for LGPD

Since LGPD is closely modeled on GDPR, using Blindfold’s EU region with the gdpr_eu policy provides excellent coverage for LGPD requirements. The gdpr_eu policy detects entity types relevant to both European and Brazilian personal data.
Brazil’s LGPD is closely aligned with GDPR. The gdpr_eu policy covers the entity types needed for LGPD compliance.

gdpr_eu Policy Coverage for LGPD

Code Examples

Tokenize Brazilian Personal Data

The most common pattern: protect Brazilian user data before any AI API call.

Anonymize for LGPD Art. 12

Use hash() to irreversibly anonymize personal data for analytics or research — satisfying LGPD’s anonymization requirements:

Right to Anonymization (Art. 18)

When a data subject exercises their right to anonymization under Art. 18(IV), tokenize their data and then delete the mapping to make anonymization permanent:

Benefits for LGPD Compliance

LGPD Compliance Checklist

1

Identify LGPD applicability

Determine if your AI application processes personal data of individuals in Brazil. LGPD applies regardless of where your organization is located.
2

Configure Blindfold with EU region

Set region="eu" in your SDK client. The EU region provides data residency aligned with LGPD requirements.
3

Apply gdpr_eu policy to all processing

Use policy="gdpr_eu" on all tokenize, redact, encrypt, and hash calls handling Brazilian personal data.
4

Tokenize personal data before AI providers

Always call blindfold.tokenize() before sending text to any LLM provider. This ensures no real personal data reaches third parties.
5

Maintain audit logs as record of processing

Export audit logs from the Blindfold Dashboard to document your processing activities as required by Art. 37.
6

Implement data subject rights

Use detect() for access requests, redact() for deletion, hash() for irreversible anonymization, and tokenize() with discarded mappings for right to anonymization.
7

Appoint a DPO (Encarregado)

Designate an Encarregado, publicly disclose their contact information, and document your data flows including how Blindfold protects personal data in AI workflows.
LGPD is evolving — the ANPD continues to issue new regulations and guidance. Review your compliance posture regularly as new ANPD resolutions are published.

Disclaimer: This documentation provides general information about LGPD compliance requirements. It is not legal advice. Consult with legal counsel familiar with Brazilian data protection law to ensure your specific implementation meets all applicable requirements.